Cybersecurity

# This is what happens to your password
import hashlib

password = "MySecretPass123!"
hashed = hashlib.sha256(password.encode()).hexdigest()
print(f"Your password: {password}")
print(f"What gets stored: {hashed}")
# Output: What gets stored: 7a37b85c8918eac19a9089c0fa5a2ab4dce3f90528dcdeec108b23ddf3607b99

import secrets
import hashlib

def secure_password_storage(password):
    import bcrypt
    
    # CRITICAL: Never use SHA256 for password hashing - it's too fast!
    # Use bcrypt, scrypt, or Argon2 instead
    
    # Generate salt and hash password with bcrypt
    # Cost factor 12 is a good default (adjust based on your security needs)
    hashed = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt(rounds=12))
    
    # bcrypt includes the salt in the hash, so no need to store separately
    return hashed

# For verification:
def verify_password(password, hashed):
    return bcrypt.checkpw(password.encode('utf-8'), hashed)

# Even identical passwords get different hashes
pwd = "CommonPassword123"
salt1, hash1 = secure_password_storage(pwd)
salt2, hash2 = secure_password_storage(pwd)
print(f"Same password, different hashes:")
print(f"Hash 1: {hash1[:32]}...")
print(f"Hash 2: {hash2[:32]}...")

from cryptography.fernet import Fernet

# Generate a key (both parties need this)
key = Fernet.generate_key()
cipher = Fernet(key)

# Encrypt a message
message = "Meet me at midnight"
encrypted = cipher.encrypt(message.encode())
print(f"Encrypted: {encrypted}")
# Output: b'gAAAAABh...long random-looking string...'

# Only someone with the key can decrypt
decrypted = cipher.decrypt(encrypted)
print(f"Decrypted: {decrypted.decode()}")
# Output: Meet me at midnight

# Easy direction: multiplication
p = 104729  # prime number
q = 103591  # prime number
n = p * q   # = 10,848,583,639

# Hard direction: factoring
# Given only n = 10,848,583,639, find p and q
# With small numbers, this is doable. With 1024-bit numbers? 
# It would take all the computers on Earth millions of years.

# Simplified elliptic curve example
# Curve: y² = x³ + ax + b (mod p)

# Point addition on curves follows special rules
# If you know point P and scalar k, computing k*P is easy
# But given P and Q = k*P, finding k is extremely hard

# This is why Bitcoin uses elliptic curves for digital signatures
# Your private key is k, your public key is k*G (where G is a known point)

# Simplified Learning with Errors (LWE) concept
# Secret: s = [2, 3, 1]
# Public: Random matrix A and b = A*s + small_error
# Even knowing A and b, finding s is hard due to the error

A = [[4, 2, 7],
     [1, 5, 3],
     [6, 8, 2]]
s = [2, 3, 1]
error = [0, 1, -1]  # Small random errors

# b = A*s + error (mod q)
# Given A and b, recover s? Extremely difficult!

# Simplified zero-knowledge proof concept
# Prover knows secret x, wants to prove they know it
# without revealing x

# 1. Commitment: Prover sends y = g^x (mod p)
# 2. Challenge: Verifier sends random challenge c
# 3. Response: Prover computes r = x + c*k (mod q)
# 4. Verify: Verifier checks that g^r = y * public_key^c

# The verifier learns nothing about x!

# Simplified homomorphic property
# If E(x) means "x encrypted", then:
# E(5) * E(3) = E(5 + 3) = E(8)
# The multiplication of encrypted values gives the encryption of their sum!

# Real application: Private voting
# Each vote is encrypted, tallies are computed on encrypted votes
# Only the final sum is decrypted—individual votes remain secret

# What happens without VPN:
# Your computer → [UNENCRYPTED] → Coffee shop WiFi → Internet
# Anyone on the same WiFi can see your traffic

# With VPN:
# Your computer → [ENCRYPTED TUNNEL] → VPN server → Internet
# Coffee shop WiFi only sees encrypted data

# Example IDS rule detecting potential SQL injection
if "SELECT" in request and "UNION" in request:
    alert("Possible SQL injection attempt detected!")
    log_attack(source_ip, request_details)
    
# More sophisticated detection uses machine learning
# to identify anomalies in network behavior

# Vulnerable code - NEVER do this!
username = request.form['username']
password = request.form['password']
query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"

# What an attacker enters:
# Username: admin' OR '1'='1' --
# Password: anything

# Resulting query:
# SELECT * FROM users WHERE username='admin' OR '1'='1' --' AND password='anything'
# This returns ALL users because '1'='1' is always true!

# Secure code - use parameterized queries
query = "SELECT * FROM users WHERE username=? AND password=?"
cursor.execute(query, (username, password))
# The database knows these are values, not SQL code

# Cloud Provider Secures:
# - Physical data centers
# - Network infrastructure  
# - Hypervisor layer
# - Physical storage

# You Secure:
# - Your data
# - Identity and access management
# - Application code
# - Operating system (in IaaS)
# - Network traffic controls
# - Encryption keys

# How supply chain attacks work:
# 1. Attacker compromises software vendor
# 2. Malicious code inserted into legitimate update
# 3. Customers install "trusted" update
# 4. Attacker now has access to all customers

# Defense: Software composition analysis
import subprocess

# Check dependencies for known vulnerabilities
result = subprocess.run(['pip-audit'], capture_output=True)
if 'vulnerability' in result.stdout.decode():
    alert_security_team()

import random
from math import gcd

def generate_rsa_keys(bits=1024):
    # Step 1: Generate two large primes
    p = generate_large_prime(bits // 2)
    q = generate_large_prime(bits // 2)
    
    # Step 2: Calculate n = p * q
    n = p * q
    
    # Step 3: Calculate Euler's totient
    phi = (p - 1) * (q - 1)
    
    # Step 4: Choose public exponent e
    e = 65537  # Common choice, must be coprime with phi
    
    # Step 5: Calculate private exponent d
    d = modular_inverse(e, phi)
    
    # Public key: (n, e)
    # Private key: (n, d)
    return (n, e), (n, d)

def encrypt_rsa(message, n, e):
    # Encryption: c = m^e mod n
    return pow(message, e, n)

def decrypt_rsa(ciphertext, n, d):
    # Decryption: m = c^d mod n
    return pow(ciphertext, d, n)

# The security relies on the fact that knowing n 
# doesn't help you find p and q (factoring is hard)

# Elliptic curve: y² = x³ + ax + b (mod p)
# Example: Bitcoin uses secp256k1: y² = x³ + 7

class EllipticCurve:
    def __init__(self, a, b, p):
        self.a = a
        self.b = b
        self.p = p  # Prime modulus
    
    def point_addition(self, P, Q):
        """Add two points on the curve"""
        if P == Q:
            # Point doubling
            s = (3 * P[0]**2 + self.a) * modular_inverse(2 * P[1], self.p)
        else:
            # Point addition
            s = (Q[1] - P[1]) * modular_inverse(Q[0] - P[0], self.p)
        
        x3 = (s**2 - P[0] - Q[0]) % self.p
        y3 = (s * (P[0] - x3) - P[1]) % self.p
        return (x3, y3)
    
    def scalar_multiplication(self, k, P):
        """Multiply point P by scalar k"""
        # This is easy to compute
        # But given P and k*P, finding k is extremely hard
        # This is the elliptic curve discrete logarithm problem

def shamir_share_secret(secret, threshold, num_shares, prime):
    """
    Split secret into n shares, need k to reconstruct
    Uses polynomial: f(x) = secret + a1*x + a2*x² + ... + ak*x^(k-1)
    """
    # Generate random coefficients
    coefficients = [secret]
    for i in range(threshold - 1):
        coefficients.append(random.randint(0, prime - 1))
    
    # Generate shares: (x, f(x)) for x = 1, 2, ..., n
    shares = []
    for x in range(1, num_shares + 1):
        y = sum(coeff * pow(x, i, prime) for i, coeff in enumerate(coefficients)) % prime
        shares.append((x, y))
    
    return shares

def reconstruct_secret(shares, prime):
    """
    Reconstruct secret using Lagrange interpolation
    """
    secret = 0
    for i, (xi, yi) in enumerate(shares):
        numerator = 1
        denominator = 1
        for j, (xj, _) in enumerate(shares):
            if i != j:
                numerator = (numerator * -xj) % prime
                denominator = (denominator * (xi - xj)) % prime
        
        lagrange = (yi * numerator * modular_inverse(denominator, prime)) % prime
        secret = (secret + lagrange) % prime
    
    return secret

# Example: Nuclear launch codes requiring 3 of 5 generals
# Each general gets one share, any 3 can launch

# Vulnerable password check
def check_password_vulnerable(input_password, correct_password):
    if len(input_password) != len(correct_password):
        return False
    
    for i in range(len(input_password)):
        if input_password[i] != correct_password[i]:
            return False  # Returns immediately on first mismatch!
    return True

# Attack: Measure how long the function takes
# Longer execution = more characters correct
# Attacker can guess password one character at a time!

# Secure constant-time comparison
import hmac

def check_password_secure(input_password, correct_password):
    # Always compares all bytes, regardless of mismatches
    return hmac.compare_digest(input_password, correct_password)

# During RSA decryption, the CPU uses more power for '1' bits than '0' bits
# By measuring power consumption during decryption, 
# attackers can recover the private key bit by bit!

# Defense: Power analysis countermeasures
def masked_multiplication(a, b):
    # Add random "mask" to hide real values
    mask = random.randint(1, 1000)
    masked_a = a ^ mask
    masked_b = b ^ mask
    # Perform operation on masked values
    result = complex_operation(masked_a, masked_b)
    # Remove mask from result
    return result ^ mask

# Add tiny, invisible changes to an image
# that completely fool an AI classifier

def create_adversarial_example(model, image, true_label):
    # Calculate gradient of loss with respect to input
    epsilon = 0.01  # Tiny perturbation
    
    # Fast Gradient Sign Method (FGSM)
    gradient = calculate_gradient(model, image, true_label)
    perturbation = epsilon * sign(gradient)
    
    # Add perturbation to image
    adversarial_image = image + perturbation
    
    # To human: looks identical
    # To AI: completely different!
    # "Stop sign" → "Speed limit 45"
    return adversarial_image

# Attacker queries your model API with carefully chosen inputs
# Uses responses to train their own copy of your model
# After enough queries, they have a functional clone!

# Defense: Rate limiting, anomaly detection, output perturbation
def protect_model_api(model, input_data):
    # Add small random noise to outputs
    prediction = model.predict(input_data)
    noise = random.normal(0, 0.01, prediction.shape)
    return prediction + noise

# IND-CPA Game (Indistinguishability under Chosen Plaintext Attack)
def ind_cpa_game(encryption_scheme, adversary):
    # 1. Generate keys
    public_key, private_key = encryption_scheme.generate_keys()
    
    # 2. Adversary can encrypt anything they want
    # (simulating real-world where attacker can trigger encryptions)
    
    # 3. Adversary chooses two messages
    m0, m1 = adversary.choose_messages(public_key)
    
    # 4. We randomly encrypt one of them
    b = random.choice([0, 1])
    ciphertext = encryption_scheme.encrypt(public_key, [m0, m1][b])
    
    # 5. Adversary tries to guess which one
    guess = adversary.guess(ciphertext)
    
    # 6. Adversary wins if they guess correctly
    return guess == b

# Secure if: Pr[adversary wins] ≈ 1/2 (random guessing)
# If adversary can win significantly more than 50%, encryption is broken!

# Example: Secure voting system combining multiple protocols
# - Encryption (for ballot privacy)
# - Digital signatures (for voter authentication)  
# - Zero-knowledge proofs (to verify vote validity)
# - Commitment schemes (to prevent vote changing)

# UC Framework proves: If each component is secure,
# the combined system is also secure

# Incident Response Checklist
def initial_response():
    # 1. Don't panic, don't turn anything off yet!
    log("Incident detected at", datetime.now())
    
    # 2. Preserve evidence
    capture_memory_dump()  # RAM contains encryption keys, passwords
    capture_network_connections()  # See what's communicating
    
    # 3. Contain the threat
    isolate_affected_systems()  # Prevent lateral movement
    
    # 4. Start documentation
    create_incident_timeline()
    
    # 5. Notify response team
    alert_security_team()

# Memory forensics example: Finding malware in RAM
def analyze_memory_dump(dump_file):
    # Look for suspicious processes
    processes = extract_process_list(dump_file)
    for proc in processes:
        if proc.parent == "svchost.exe" and proc.name == "cmd.exe":
            # svchost shouldn't spawn command prompts!
            flag_suspicious(proc)
    
    # Extract network connections
    connections = extract_network_connections(dump_file)
    for conn in connections:
        if conn.destination_port == 4444:  # Common backdoor port
            flag_suspicious(conn)
    
    # Look for injection techniques
    for proc in processes:
        if has_injected_code(proc):
            extract_injected_code(proc)

# Example: Detecting brute force attacks
# SIEM query to find multiple failed logins
query = """
index=auth action=failed 
| stats count by src_ip, username 
| where count > 5 
| eval risk_score = count * 10
| sort -risk_score
"""

# But smart attackers know about SIEMs...
# They might try 4 attempts, wait, then try 4 more
# So we need smarter detection:

advanced_query = """
index=auth action=failed
| bucket _time span=1h
| stats count by src_ip, username, _time
| streamstats sum(count) as total_count by src_ip, username time_window=24h
| where total_count > 10
"""

# Hunting for data exfiltration
def hunt_data_exfiltration(network_logs):
    # Look for unusual data transfers
    for connection in network_logs:
        # Large upload to uncommon destination?
        if (connection.bytes_sent > 100_000_000 and  # 100MB+
            connection.destination not in known_services):
            investigate(connection)
        
        # DNS tunneling? (hiding data in DNS queries)
        if (connection.protocol == 'DNS' and
            len(connection.query) > 100):  # Unusually long domain
            flag_suspicious(connection)
        
        # Beaconing? (malware calling home)
        if is_periodic(connection.timestamps, tolerance=60):  # Every ~60 seconds
            investigate(connection)

# GDPR requires "privacy by design"
class UserDataHandler:
    def __init__(self):
        self.purpose_limitation = True  # Only use data for stated purpose
        self.data_minimization = True   # Collect minimum necessary
        self.retention_limit = 90       # Delete after 90 days
    
    def collect_user_data(self, user):
        # Must have explicit consent
        if not user.has_consented():
            raise GDPRViolation("No consent for data collection")
        
        # Right to be forgotten
        if user.requests_deletion():
            self.delete_all_user_data(user)
            self.log_deletion(user)  # Prove compliance
    
    def data_breach_notification(self):
        # Must notify within 72 hours!
        notify_authorities()
        if high_risk_to_individuals():
            notify_affected_users()

# PCI DSS Requirement 3: Protect stored cardholder data
# NEVER store:
# - Full magnetic stripe data
# - CVV/CVC (the 3-digit code)
# - PIN

# If you must store card numbers:
def store_card_number(card_number):
    # Requirement 3.4: Render PAN unreadable
    # Show only first 6 and last 4 digits
    masked = card_number[:6] + "*" * (len(card_number) - 10) + card_number[-4:]
    
    # Encrypt the full number
    encrypted = strong_encryption(card_number)
    
    # Store with restricted access
    store_with_access_control(encrypted, access_level="PCI_AUTHORIZED_ONLY")

# Classical computer solving RSA
def classical_factor(n):
    # Try all possible factors
    for i in range(2, int(sqrt(n))):
        if n % i == 0:
            return i, n // i
    # For 2048-bit numbers: billions of years

# Quantum computer with Shor's algorithm
def quantum_factor(n):
    # Use quantum superposition to try all factors simultaneously
    # Find period of function f(x) = a^x mod n
    # Use period to find factors
    # For 2048-bit numbers: hours or days

# AI-powered defense
class AISecurityAnalyst:
    def detect_anomalies(self, network_traffic):
        # Learn normal behavior patterns
        baseline = self.model.learn_baseline(historical_traffic)
        
        # Detect deviations
        for packet in network_traffic:
            anomaly_score = self.model.predict_anomaly(packet)
            if anomaly_score > threshold:
                # AI found something human analysts might miss
                investigate(packet)
    
    def respond_to_threats(self, threat):
        # AI can respond faster than humans
        response = self.model.recommend_response(threat)
        if confidence > 0.95:
            execute_response(response)  # Automatic mitigation
        else:
            alert_human_analyst(threat, response)  # Human decision needed

# But attackers use AI too...
class AIAttacker:
    def generate_phishing_email(self, target):
        # AI creates personalized, convincing phishing emails
        profile = scrape_social_media(target)
        email = self.language_model.generate(
            f"Write email to {target.name} about {target.interests}"
        )
        return email
    
    def evade_detection(self, malware):
        # AI modifies malware until it bypasses antivirus
        while detected_by_antivirus(malware):
            malware = self.model.mutate(malware)
        return malware

# Traditional security model
if request.source_ip in internal_network:
    allow(request)  # DANGEROUS!

# Zero Trust model
def handle_request(request):
    # Verify everything, every time
    if not verify_identity(request.user):
        return deny()
    
    if not verify_device(request.device):
        return deny()
    
    if not verify_location(request.location):
        return deny()
    
    if not verify_authorization(request.user, request.resource):
        return deny()
    
    # Continuous verification
    monitor_behavior(request)
    
    return allow()

def assess_security_risks():
    risks = []
    
    # What are your crown jewels?
    critical_assets = identify_critical_assets()
    # Customer data? Source code? Trade secrets?
    
    for asset in critical_assets:
        # What threatens this asset?
        threats = identify_threats(asset)
        # Hackers? Insiders? Natural disasters?
        
        # How vulnerable are you?
        vulnerabilities = assess_vulnerabilities(asset)
        # Unpatched systems? Weak passwords? No backups?
        
        # What's the impact if compromised?
        impact = calculate_impact(asset)
        # Financial loss? Reputation damage? Legal liability?
        
        risk_score = threats * vulnerabilities * impact
        risks.append((asset, risk_score))
    
    # Focus on highest risks first
    return sorted(risks, key=lambda x: x[1], reverse=True)

class SecurityAwarenessProgram:
    def __init__(self):
        self.training_modules = [
            "Recognizing Phishing",
            "Password Security",
            "Physical Security",
            "Social Engineering",
            "Incident Reporting"
        ]
    
    def conduct_phishing_test(self):
        # Send harmless phishing email to employees
        results = send_test_phishing_campaign()
        
        for employee in results.clicked_link:
            # Don't punish—educate!
            provide_immediate_training(employee)
            
        # Track improvement over time
        self.metrics.record(results)
    
    def gamify_security(self):
        # Make security fun
        return {
            "Security Champion badges",
            "Spot the Phish contests",
            "Capture the Flag events",
            "Security escape rooms"
        }

class SecureDevelopmentLifecycle:
    def design_phase(self):
        # Threat modeling BEFORE coding
        threats = perform_threat_modeling()
        security_requirements = derive_security_requirements(threats)
        
    def coding_phase(self):
        # Security-focused code reviews
        enforce_secure_coding_standards()
        use_static_analysis_tools()  # Find bugs before they ship
        
    def testing_phase(self):
        # Security testing is not optional
        run_static_analysis()        # SAST
        run_dynamic_analysis()       # DAST  
        perform_penetration_test()   # Manual testing
        check_dependencies()         # Software composition analysis
        
    def deployment_phase(self):
        # Secure configuration
        harden_infrastructure()
        implement_monitoring()
        prepare_incident_response()
        
    def maintenance_phase(self):
        # Security doesn't end at deployment
        monitor_for_vulnerabilities()
        apply_patches_promptly()
        conduct_regular_assessments()

# Security culture indicators
class SecurityCulture:
    def measure_culture_health(self):
        return {
            "password_manager_adoption": "85%",
            "phishing_report_rate": "high",
            "security_champion_volunteers": "growing",
            "shadow_it_usage": "declining",
            "incident_reporting_time": "< 1 hour average"
        }
    
    def build_security_culture(self):
        # Make security everyone's responsibility
        initiatives = [
            "Executive support and visible commitment",
            "Regular security awareness training",
            "Reward security-conscious behavior",
            "Blameless post-mortems for incidents",
            "Security champions in each team",
            "Make the secure path the easy path"
        ]
        return initiatives

def start_your_security_journey():
    steps = [
        "Enable MFA on all important accounts",
        "Use a password manager",
        "Keep software updated",
        "Learn to recognize phishing",
        "Understand what data you're protecting",
        "Practice incident response",
        "Stay informed about new threats",
        "Share knowledge with others"
    ]
    
    for step in steps:
        take_action(step)
        # Security improves one step at a time
    
    return "You're now more secure than 90% of targets"

# Each hospital has private patient data
hospital_a_data = [patient_records_a]
hospital_b_data = [patient_records_b]
hospital_c_data = [patient_records_c]

# Using MPC, they can compute statistics without sharing data
result = secure_multiparty_computation(
    function="calculate_treatment_effectiveness",
    inputs=[hospital_a_data, hospital_b_data, hospital_c_data]
)

# Each hospital learns only the final result
# No individual patient data is ever shared!

def differentially_private_average(data, epsilon=1.0):
    # Add carefully calibrated noise
    true_average = sum(data) / len(data)
    
    # Laplace noise scaled to sensitivity/epsilon
    sensitivity = max_value - min_value
    noise = numpy.random.laplace(0, sensitivity/epsilon)
    
    private_average = true_average + noise
    
    # Result is useful for analysis but doesn't reveal
    # information about any individual
    return private_average

# Transparent Certificate Authority
class BlockchainCA:
    def issue_certificate(self, domain, public_key):
        cert = {
            "domain": domain,
            "public_key": public_key,
            "timestamp": time.now(),
            "issuer": self.identity
        }
        
        # Add to public blockchain
        # Anyone can verify certificates
        # Impossible to issue fake certs without detection
        blockchain.add_block(cert)